More on LinuxToday

Progeny Security Advisory: gnupg format string vulnerability

From: Progeny Security Team <security@progeny.com>
Subject: PROGENY-SA-2001-16: gnupg format string vulnerability
Date: Wed, 30 May 2001 17:11:19 -0500 (EST)
---------------------------------------------------------------------------
PROGENY SERVICE NETWORK -- SECURITY ADVISORY PROGENY-SA-2001-16
---------------------------------------------------------------------------
Synopsis: gnupg format string vulnerability
Software: gnupg
History:
2001-05-29 Vulnerability announced
2001-05-29 Vendor patch/fix available
2001-05-30 Update available in Progeny archive
Credits: fish stiqz <fish@synnergy.net>
Affects: Progeny Debian (gnupg prior to 1.0.4-2progeny1)
Progeny Only: NO
Vendor-Status: New Version Released
(gnupg_1.0.4-2progeny1)
$Progeny: security/advisory/PROGENY-SA-2001-16,v 1.1 2001/05/30 22:04:10 jdaily Exp $
---------------------------------------------------------------------------
SUMMARY
Gnu Privacy Guard (GnuPG, aka GPG) is an encryption program that
provides functionality similar to PGP. It contains a format string
vulnerability that can be used to invoke shell commands with
the currently logged-on user's privileges.
DETAILED DESCRIPTION
One indirect invocation of vfprintf neglects to pass "%s" as the first
argument, allowing a filename to include format strings and with
careful planning invoke arbitrary shell code.
Note that the name of the file to be decrypted is irrelevant; what
matters is the filename that was originally encrypted.
In practice, this would be difficult to exploit reliably, but sample
code for Linux has been published to Bugtraq that provides a remote
shell.
SOLUTION (See also: UPDATING VIA APT-GET)
Upgrade to a fixed version of gnupg. gnupg version 1.0.4-2progeny1
corrects the problem. For your convenience, you may upgrade to the
gnupg_1.0.4-2progeny1 package.
UPDATING VIA APT-GET
1. Ensure that your /etc/apt/sources.list file has a URI for Progeny's
update repository:
deb http://archive.progeny.com/progeny updates/newton/
2. Update your cache of available packages for apt(8).
Example:
# apt-get update
3. Using apt(8), install the new package. apt(8) will download the
update, verify its integrity with md5, and then install the
package on your system with dpkg(8).
Example:
# apt-get install gnupg
UPDATING VIA DPKG
1. Use your preferred FTP/HTTP client to retrieve the following
updated files from Progeny's update archive at:
http://archive.progeny.com/progeny/updates/newton/
MD5 Checksum Filename
-------------------------------- -------------------------------------
ede2df0c58899edce9e654c6f28a3edb gnupg_1.0.4-2progeny1_i386.deb/
Example:
$ wget \
http://archive.progeny.com/progeny/updates/newton/gnupg_1.0.4-2progeny1_i386.deb
2. Use the md5sum(1) command on the retrieved files to verify that
they match the MD5 checksum provided in this advisory:
Example:
$ md5sum gnupg_1.0.4-2progeny1_i386.deb
3. Then install the replacement package(s) using dpkg(8).
Example:
# dpkg --install gnupg_1.0.4-2progeny1_i386.deb
WORKAROUND
No known workaround exists for this vulnerability.
MORE INFORMATION
The GnuPG homepage is located at http://www.gnupg.org/
The original post to Bugtraq with full details can be found at
http://archives.indenial.com/hypermail/bugtraq/2001/May2001/0275.html.
Progeny advisories can be found at http://www.progeny.com/security/.
---------------------------------------------------------------------------
pub 1024D/F92D4D1F 2001-04-04 Progeny Security Team <security@progeny.com>

Please enable Javascript in your browser, before you post the comment! Now Javascript is disabled.